Overview
Seatly Software Ltd (“Seatly”) engages the following sub-processors to provide its restaurant booking SaaS platform. Each sub-processor has been assessed for compliance with UK GDPR and the UK Data Protection Act 2018. This document forms part of Seatly’s Data Processing Agreement (DPA) and is incorporated by reference into Seatly’s Privacy Policy.
Restaurant clients (data controllers) are notified of any changes to this list at least 30 days in advance via email to their registered account address. Clients may object to a new or changed sub-processor within that 30-day window by contacting privacy@seatly.uk. Where an objection cannot be resolved, either party may terminate the relevant service on written notice.
Sub-Processor Table
| Sub-Processor | Registered Address | Purpose | Personal Data Processed | Data Location | Transfer Mechanism | Sub-Processor DPA |
|---|---|---|---|---|---|---|
| Supabase Inc. | 970 Toa Payoh North, #07-04, Singapore 318992 | Database hosting, authentication, Edge Functions (serverless compute) | All booking and customer data: diner name, email address, phone number, booking details; restaurant staff credentials | Database: London, UK (AWS eu-west-2). Edge Functions: the Supabase region nearest the request, which may be outside the UK | Primary hosting in UK. Seatly does not intentionally store core booking data outside the UK. Edge Functions running outside the UK, and any remote access by the provider, are covered by Supabase’s DPA, which incorporates Standard Contractual Clauses (SCCs) with the UK Addendum. | Supabase DPA |
| Resend (Plus Five Five, Inc.) | 2261 Market Street #5039, San Francisco, CA 94114, USA | Transactional email delivery (booking confirmations, reminders, cancellation notices) | Diner name, email address, booking reference, booking date and time, party size, restaurant name, any deposit amount, the manage-booking link, and any special requirements the diner entered; restaurant staff email addresses, for the operational notifications the restaurant sets up, such as the weekly summary | United States | Standard Contractual Clauses (SCCs) with the UK Addendum, in Resend’s DPA, and the UK Extension to the EU-U.S. Data Privacy Framework | Resend DPA |
| Stripe Payments Europe, Limited, with Stripe Payments UK Ltd providing regulated payment services in the UK | Stripe Payments Europe, Limited: One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Stripe Payments UK Ltd: 9th Floor, 107 Cheapside, London, EC2V 6DN, United Kingdom | Diner deposit and pre-payment collection (group bookings, private dining, prime-time slots, and ticketed events) via Stripe Checkout, taken on the restaurant’s own connected Stripe account (Stripe Connect), including refunds and dispute notifications | Where a restaurant enables deposits or pre-payments: diner name, email address, and payment card details — entered on Stripe’s own hosted checkout page and held by Stripe. Seatly never stores diner card details. | European Union, United States and other countries, including India | UK IDTA / Standard Contractual Clauses (SCCs) | Stripe Privacy & DPA |
| Cloudflare Inc. | 101 Townsend Street, San Francisco, CA 94107, USA | CDN, DNS, Pages hosting (widget and marketing site delivery), Turnstile anti-spam service; Cloudflare Web Analytics — cookieless aggregate page-view and performance measurement on the seatly.uk marketing site; Workers AI — generates the plain-English summary sentence in the weekly insights email from anonymous aggregate booking statistics only (no personal data); Workers — serves the restaurant’s private calendar (iCal) feed of its bookings on feeds.seatly.uk, passing it on from Seatly’s database | IP addresses, Turnstile challenge tokens (ephemeral, not linked to individuals). Workers AI processes aggregate counts only (total bookings, covers, cancellation rate, average party size, covers-by-day) — no names, email addresses, or phone numbers are passed to Workers AI. Where a restaurant subscribes to its calendar feed, the feed carries each upcoming booking’s diner name, booking reference, date and time, party size, service, seating area and special requirements — never email addresses, phone numbers or payment details. | Global edge network (EU inference preferred for Workers AI) | UK IDTA / Standard Contractual Clauses (SCCs) | Cloudflare DPA |
| PostHog Inc. | 2261 Market Street #4008, San Francisco, CA 94114, USA | Cookieless website analytics for the seatly.uk marketing site (aggregate page views, referrers, scroll depth, section visibility, interaction events); session replay on the marketing pages where the visitor has consented to it | Aggregate, pseudonymised usage events; a daily-rotated hash derived from IP address and user agent (raw IP discarded within 24 hours, never retained by Seatly); page URLs and referrer domains. No names, email addresses, or booking data. Where a visitor consents to session replay: a recording of their interaction with the marketing pages (pointer movement, scrolling, clicks, rendered page) with all form inputs masked, plus a session identifier stored in their browser. Replay never runs on diner-facing or widget surfaces. | EU (Frankfurt, Germany — PostHog EU Cloud) | Not required — processing remains in the EEA, permitted under the UK’s EEA adequacy regulations | PostHog DPA |
| Celerity Messaging UK Ltd (trading as BulkSMS.com) | 1st Floor Sackville House, 143–149 Fenchurch Street, London, EC3M 6BN, United Kingdom | Text (SMS) delivery — booking reminder texts and walk-in “table ready” notifications, delivery receipts, and inbound opt-out events | Diner phone number, text message content (diner first name, restaurant name, booking or queue details), delivery status | Republic of Ireland (AWS); limited group support access from Cape Town, South Africa | Hosting in Ireland (EEA) is covered by the UK’s adequacy regulations; the provider’s DPA incorporating Standard Contractual Clauses (SCCs) covers any South Africa support access | BulkSMS DPA |
Stripe also takes Seatly’s own subscription payments from restaurant clients. Seatly is the controller for that data, not a processor acting for the restaurant, so it is described in section 10 of the Privacy Policy rather than here.
Transfer Mechanisms — Definitions
- UK primary hosting — the provider’s database is in the United Kingdom. Seatly does not intentionally store core booking data outside the UK for this service. Any onward or remote access by the provider is governed by their contractual safeguards where applicable.
- UK IDTA — UK International Data Transfer Agreement, issued by the Information Commissioner under section 119A of the Data Protection Act 2018 and so a safeguard under Article 46(2)(d) UK GDPR, used for transfers to countries not covered by the UK’s adequacy regulations.
- Standard Contractual Clauses (SCCs) — European Commission standard data protection clauses, used for UK transfers with the ICO’s International Data Transfer Addendum to the EU SCCs (the UK Addendum). The UK Addendum is also issued by the Information Commissioner under section 119A of the Data Protection Act 2018, so SCCs used with it are a safeguard under Article 46(2)(d) UK GDPR.
- UK Extension to the EU-U.S. Data Privacy Framework — US organisations certified under it are covered by the UK’s adequacy regulations for the United States, so transfers to them are permitted without further safeguards.
- UK adequacy (EEA): transfers to the European Economic Area are permitted without further safeguards under the UK’s adequacy regulations for the EEA.
Change Log
| Version | Date | Changed By | Summary of Changes |
|---|---|---|---|
| 1.0 | 2026-04-15 | Seatly Software Ltd | Initial publication |
| 1.1 | 2026-06-19 | Seatly Software Ltd | Added Workers AI as an additional purpose for Cloudflare Inc. (weekly insights email digest — aggregate data only, no personal data) |
| 1.2 | 2026-08-04 | Seatly Software Ltd | Corrected the Stripe entry: since deposit and pre-payment collection launched, Stripe also processes diner payment data (name, email, card details entered on Stripe’s hosted checkout) for payments settled to the restaurant’s connected account — the previous “no diner personal data” statement no longer held. Added Celerity Messaging UK Ltd (BulkSMS.com) as the text-message delivery sub-processor. |
| 1.3 | 2026-08-26 | Seatly Software Ltd | Added PostHog Inc. (cookieless marketing-site analytics, EU); documented Cloudflare Web Analytics on the existing Cloudflare entry |
| 1.4 | 2026-09-12 | Seatly Software Ltd | Extended the PostHog entry with consent-gated session replay on the marketing pages (masked inputs, 30-day retention, EU Cloud). Seatly is the controller for this processing, not a processor for any restaurant, and it never runs on diner-facing or widget surfaces. |
| 1.5 | 2026-10-01 | Seatly Software Ltd | Stripe entry corrected. It named Stripe Inc. (USA), but Stripe’s own terms name Stripe Payments Europe, Limited as the contracting party for UK businesses, with Stripe Payments UK Ltd providing regulated payment services in the UK; both are now listed with their registered addresses. Seatly’s own subscription billing removed from the entry: Seatly is the controller for that data, not a processor for any restaurant, and it is now described in section 10 of the Privacy Policy. Deposits described as taken on the restaurant’s own Stripe account, including refunds and dispute notifications. Data location extended to the other countries, including India, that Stripe’s own privacy policy names. |
| 1.6 | 2026-10-09 | Seatly Software Ltd | Supabase entry corrected. It gave London as the only data location, but Supabase’s Edge Functions (serverless compute) run in the Supabase region nearest the request, which may be outside the UK. The database stays in London. The entry now says so, and names the safeguard for that processing: Standard Contractual Clauses with the UK Addendum, in Supabase’s DPA. The Cloudflare entry now includes the Workers proxy that serves each restaurant’s private calendar (iCal) feed of its bookings on feeds.seatly.uk, and the diner details that feed carries. The Resend entry now lists everything the booking emails carry, not only the diner’s name, email address and booking reference, and the restaurant staff email addresses that receive operational notifications such as the weekly summary, as the Data Processing Agreement’s Annex A already did. The Resend entry gave its transfer mechanism as “UK IDTA / Standard Contractual Clauses (SCCs)”; Resend’s own DPA (last updated 31 December 2025) uses SCCs with the UK Addendum and the UK Extension to the EU-U.S. Data Privacy Framework, and does not use the UK IDTA, so the entry now says that, and the UK Extension is added to the definitions. The UK primary hosting definition now says the provider’s database is in the United Kingdom, not that data is stored there. The Transfer Mechanisms definitions now cite Article 46(2)(d) UK GDPR, not Article 46(2)(c), for the UK IDTA and for SCCs, and name the Addendum used with the SCCs as the ICO’s International Data Transfer Addendum to the EU SCCs (the UK Addendum), in place of “the UK IDTA addendum”: the IDTA and the UK Addendum are issued by the Information Commissioner under section 119A of the Data Protection Act 2018, which Article 46(2)(d) covers, while Article 46(2)(c) covers clauses the Secretary of State specifies in regulations. The Resend entry now gives Resend’s contracting entity, Plus Five Five, Inc., and the address its DPA gives, in place of “Resend Inc.” at 2261 Market Street #5284, and the UK IDTA definition says “countries not covered by the UK’s adequacy regulations” in place of “third countries without an adequacy decision”. These correct the description of existing arrangements; this version adds no new sub-processor. |